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LO ver amness, 


Introduction 


This booklet is intended as a brief introduction to the 
concept of business resumption planning and provides 
suggestions and guidelines on how to go about preparing a 
business resumption plan tailored to the needs of virtually 
any business or organization. 


In the context of this booklet, the term “business” applies 
to virtually all economic activities in the private and public 
sector and the information on business resumption 
planning is intended as an overview of the concept rather 
than providing a detailed methodology. 


Further information on business resumption planning is 
available from various vendors, consultants and 
professional associations. [See Appendix 3 for a list of 
non-profit professional associations. | 


A booklet on a related subject, The Preservation of 
Essential Records: a guide for governments, organizations, 
institutions and businesses is available from Emergency 
Preparedness Canada. [See Appendix 3 for how to order.] 
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What is business resumption planning? 


Business resumption planning can be defined as “planning 
to ensure the continued availability of essential services, 
programs and operations, including all the resources 
involved.” Business resumption planning prepares an 
organization to respond to an interruption of essential 
business functions and provides the guidelines to fully 
recover operations, services and programs. 


Why have a business resumption plan? 


Every organization is at risk to some extent. Your building 
could be seriously damaged by a fire, tornado, earthquake 
or explosion. Floods originating inside or outside your 
building could affect your operations. A prolonged power 
outage, sabotaged computer system or destroyed 
equipment can also shut your organization down. Your 
managers and employees could be killed or badly injured. 
Your facilities, inventory and essential information could 
be inaccessible for a prolonged period. 


If any of these dramatic events — or many others of a less 
drastic nature occur — your organization may be unable to 
continue operating. If the interruption continues, the 
ability of your business to survive may be threatened. You, 
your management and staff should help determine when 
that critical point is reached. Before that happens, you 
should arm yourself with a business resumption plan. 
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How can a business resumption plan help 
an organization “‘stay in business” 
following an unplanned interruption? 


A 


A good business resumption plan identifies the pre-set 
arrangements you need to have on “stand-by” in order 
to get vital functions operating again with as little delay 
as possible. 


A good business resumption plan ensures the 
availability of necessary resources including personnel, 
information, equipment, financial arrangements, 
services and accommodations. 


A good business resumption plan helps an operation to 
survive an unplanned interruption by making sure 
essential clients needs can be met until normal 
operations are resumed. 


Steps toward producing a good business 
resumption plan 
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Clearly define the essential aspects of the business you 
are in. 


Determine the essential activities that must continue in 
order for your organization to continue functioning and 
list them in order of urgency and importance. 


Do a business impact analysis to determine the impact 
on your organization of the loss of those essential 
functions in dollars and cents. 


Involve your operations managers and key employees 
in the development of the plan. It’s their plan as well as 
yours. Implementation of the plan will be easier if they 
have helped develop the plan and feel responsible for 
its success. 


Develop a recovery strategy by determining what 
resources are needed, where they can be acquired, and 
the costs involved. 


Address the requirement for alternative resources (e.g. 
alternate accommodations, furniture, computers and 
other office equipment, phone service, essential 
records, and inventory items necessary to continue 
essential business functions.) Remember that alternate 
resources in the same geographical location may be 
knocked out by the same disaster affecting you. 


Write a business resumption plan that is simple, 
straightforward, and easy to understand. 


A business resumption plan is no good unless it is realistic, 
up-to-date, tested and is well known by those who must 
implement it, possibly in the midst of post-emergency 
chaos. 


Some prerequisites for successful business 
resumption planning 


A Senior management must be actively involved in the 


development of the business resumption plan. They 
must: 

- agree to the need for such a plan 

- assign the necessary resources for plan development 


- concur in the selection of essential activities and 
priority for recovery 

- agree to back-up arrangements and the costs involved 

- be prepared to authorize activation of the plan, should 
the need arise 


A A large organization should have a project co-ordinator 
to develop the plan. The plan should be developed with 
input from managers and employees at all levels who 
will be involved in implementing the plan. 


A Someone must be assigned to keep the plan up-to-date 
and to implement it, if necessary. 


A Don’t be intimidated or overwhelmed by the prospect 
of developing a business resumption plan. Develop a 
planning schedule and work on the plan step-by-step 
and in stages, if necessary. 


A Remember that preparing a business resumption plan is 
not a “one-shot” project or a one-time activity but 
rather an integral part of an effective business strategy. 
A completed plan needs to be reviewed, tested and 
updated regularly if it is to be effective when put into 
action. 


A sample step-by-step guide to developing a business 
resumption plan is included in Appendix I of this booklet 
and a business resumption plan checklist is included in 
Appendix 2. 


APPENDIX I 


A step-by-step guide to preparing a 
business resumption plan 


The following is offered as a flexible model for developing 
a business resumption plan. The steps, questions and other 
suggestions should be adapted to address the individual 
situation of the business or organization for which the plan 
is being developed. 


1. List the major functions or activities of your 
business or organization. 
(in a large organization, list the functions or activities of 
each unit, division, department, branch etc.) 


2. Determine which activities are ‘time-critical’ 
business functions 
A “time critical” business function is a service or 
activity whose continued operation is considered 
essential by management. Non-performance of this 
function would significantly impair the successful 
functioning of the business or organization. 


Consider the following as they apply to your business 

or organization: 

- what functions would have to be done immediately 
after a business interruption? What could be 
postponed? 


- What are your external requirements on a day-to-day 
basis? What do you need from outside your business/ 
organization in order to be able to continue to 
function? 


- What are your immediate internal requirements? 
Where do they come from? 


- How long can your essential business functions be 
inoperative? 


- Are there regulatory requirements or penalties that 
must be considered if you cannot fulfil your 
obligations due to an unplanned business 
interruption? 


- What is the financial impact of non-performance of a 
business function? How significant is this impact? 
Is it measurable? 


- What are the costs to respond/recover versus the 
short-term lost revenue? 


- Are other organizations dependent on functions that 
your business or organization performs? What are 
your external outputs? 


- What legal or contractual liabilities would arise if the 
activities were curtailed or shut down’? 


- What would be the public relations implications of a 
curtailment of your activities or a shut-down of your 
business? 


- Would the safety cr security of personnel and 


property be jeopardized if your operations were 
interrupted? 
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- Which of your essential operations are dependent on 
computer support? [Mainframe, WAN, LAN and 
stand-alone] Are there alternative manual operating 
procedures in place with people who know how to 
use them? How long could these operations be 
performed without computer support? 


Are there provisions for overtime for staff and for 
additional or replacement staffing? 


List important clients or contacts, external and 
internal. 


Identify essential operating information for vital 
business functions and prepare a checklist of essential 
records. Maintain copies of essential records off-site. 


Determine what essential office equipment is 
required. Specify any special computer hardware, 
software, databases, networks or other technology. 


Identify your work in progress. Determine the work 
flow and business impact if the identified information 
and work in progress were destroyed and could not be 
recovered. 


- Identify any work in progress for your business or 
organization that is being done outside your facility. 


3. Assign a priority to each of the ‘‘time-critical”’ 
activities you have identified. 
One way of assigning priorities is to assign a numeric 
scale from | to 5 to show the length of time the activity 
can remain disrupted. For example: 
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<I day - | day = _ priority 1 


2-4days = _ priority2 
De edaysieP=!ospriority 3 
8-10 days = _ priority4 
more than 10 days = _ priority 5 


- Develop a planning objective for each activity. 

A planning objective states your goal for resuming each 
activity, specified to a level of service and within a 
specific timeframe. 


For example: 

- To staff essential or designated positions at an 
alternate site within four hours of the business 
interruption. 


- To have alternate information processing 
arrangements that will meet essential computer 
requirements within 48 hours of the business 
interruption. 


- To be capable of answering 50% of incoming 
customer calls within one hour and 100% of calls 
within four hours of an interruption. 


. Determine the minimum needs for initial response 
The ability to communicate with your employees, 
suppliers, customers etc. is the key aspect to an 
effective initial response. Plan this aspect first. Then: 


- List essential information sources (operating 
instructions, manuals, databases) and alternate 
sources for this information. 


- List essential equipment needs (telephones, 
computers etc.) and sources of alternative equipment. 
Have all support services been considered? 


- List key positions within your organization or within 
another organization that are needed to assist with 
recovery. 


6. Obtain senior management approval of the 
essential functions, priorities and planning 
objectives you have identified. 

This important step gives senior management an 
outline of the plan being developed and an opportunity 
to confirm any of their previous risk management 
decisions as senior management may not be aware of 
the implications and liabilities they face if there is a 
prolonged business interruption. 


7. Delegate planning assignments to the staff who 
carry out the essential activities on a day-to-day 
basis. 

The people who perform a job on a regular basis are 
the best qualified to work on a business resumption 
plan that will allow them to resume essential activities 
following an unplanned business interruption. 


8. Write the detailed portions of the plan. 
Focus on the impact of the business interruption, not 
on the cause of the interruption. Each part of your 
business/organization must deal with what must be 
done to recover the essential activities if staff are 
incapacitated, information lost, facilities or assets 
destroyed or rendered inaccessible. Each section of 
the plan should stand alone. 


10. 


11. 


The plan for each part of your business/organization 
and the final plan for the business/organization as a 
whole, should incorporate the costs of implementation 
in terms of personnel and financial resources. 


Your plan should also cover staffing requirements 
such as replacement personnel, extraordinary staff 
expenses and health and safety factors. 


Consolidate all sections of the plan into a business 
resumption plan for your entire business/ 
organization. 

The plans for each unit, division, department etc. 
should be assembled to form the business resumption 
plan for your business/organization as a whole. 

The restricted and confidential parts of the plan should 
be protected. 


Communicate the plan to employees. 

All employees should be aware that a plan, authorized 
by senior management, exists. It should be explained, 
if necessary, in a series of information sessions, to the 
key employees that will be involved in implementing 
the plan after a business interruption. 


Store and keep copies of the plan in a secure off- 
site location away from your main office so it will 
not be destroyed or made inaccessible by the same 
event that disrupted your business operation. 
Make sure the off-site location is accessible to you 
24 hours a day. 
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12. Test the plan. 
Conduct a test of the plan in a realistic fashion and 
with ample warning to all employees that the plan 1s 
being tested. If you don’t test the plan, you risk not 
having it work in a real emergency situation. The plan 
can be tested in stages or levels ranging from a “‘table- 
top exercise” to a full-scale simulation of a post- 
disaster situation. 


13. Review your business resumption plans on a 
regular basis and update it as required to reflect 
any changes in essential activities, priorities etc. 


NOTE: Several software packages are available to help 
reduce the burden of data manipulation and 
updating a business resumption plan. The 
programs range from simple word processor 
outlines of plan development requirements (fill- 
in-the-blanks style) to comprehensive relational 
databases combined with word processing 
capabilities. Individual businesses/organizations 
should evaluate these software products with a 
view to maintaining simplicity while providing all 
the elements needed for a successful response and 
recovery process. 
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APPENDIX 2 


A business resumption plan checklist 


This checklist is to help you decide whether your business 
resumption plan is adequate. It presents a suggested list of 
questions against which your plan can be checked to 
determine if changes or adjustments are needed. The 
questions are not intended to be exhaustive and should be 
adapted to apply to your particular organization. 


Each business or organization should develop its own 
checklist, based on its particular business resumption plan, 
mandate, business, and potential types of unplanned 
business interruptions. Health and safety considerations 
are also included. 


Personnel 


|_| Have key employees seen the business resumption 
plan and are all employees aware that there is such a 
plan? 


|_| Have employees been told their specific roles and 
responsibilities if the business resumption plan is put 


into effect? 


[] Have information sessions on the business resumption 
plan been held? 
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Does your business resumption plan include home 
telephone numbers/beeper/cellular phone number etc. 
of employees with key roles in implementing the 
plan? [Can you contact them on a 24-hour basis, if 
necessary, while they are on vacation or otherwise 
away from the office?] 


Do designated employees know who does what in the 
event of an emergency? 


Have people with special needs been identified and 
provisions made for them? 


Does your business resumption plan provide a means 
for replacement staff when necessary’? 


Building premises 
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Consider the condition of your building(s) — old, 
recently retrofitted or new and the impact this may 
have on some details of your business resumption 
plan. 


Do you have access to a building engineer who can 
inspect the building and facilities soon after a disaster 
so that damage can be identified and repaired to make 
the premises safe for the return of employees as soon 
as possible? 


Is there a plan for the regular inspection of the 
building(s) and facilities, with an inspection checklist? 


Are there hazards in adjoining or neighbouring 
buildings that could endanger life or your business/ 
organization? 


Do you have plans for alternative shelter, if needed? 


Do employees know where the alternative facilities 
are located? 


What is the risk of failure of such systems as electrical 
power, natural gas, toxic chemical containers and 
pipes? 


Are toxic materials safely stored? 
If public or general transportation is disrupted, will 


that affect your operations? Has this aspect been 
considered in your business resumption plan? 


Information technology 
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What arrangements exist for emergency 
telecommunications? 


Have provisions been made so that employees can 
communicate with their families without overloading 
telephone circuits? 


Is there a plan for alternative means of data 
transmission if the computer network is interrupted? 
Is the plan in writing? Are key staff aware of it? Has 
the security of alternative means of transmission been 
considered? 


How frequently do you test your recovery plan for 
electronic data processing? For communications 
during an emergency? 


Does your business resumption plan incorporate a 
review of computer operations and analyze 
networking and interdependencies between computers 
and systems? 


Are computers protected from leakage from fire 
sprinklers and pipes on upper floors? 


Does your business resumption plan consider 
accessability to a back-up power generator? 


Administrative procedures 
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Does your business resumption plan cover 
administrative and management aspects in addition to 
operations? Is there a management plan to maintain 
operations if your headquarters is severely damaged or 
if access is denied or limited for an extended period of 
time? 


If some or all of senior management are unable to 
work, does your business resumption plan have 
procedures that will enable others to assume these 
responsibilities? (Is there an executive succession 
plan?) 


Is there a designated emergency operations centre 
where incident management teams can co-ordinate 
response and recovery? 


Have essential records been identified? Do you have 


a duplicate set of essential records stored in a secure 
and approved location? 
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Are essential records separated for easy retrieval from 
those that will not be needed immediately? 


Is there a review procedure to check the protective and 
emergency devices in offices? (alarm systems, 
security procedures) 


Does your business resumption plan include the 
names and phone numbers of suppliers of essential 
equipment and other material? 


Contracts 
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Do any of your contractors provide a service or deliver 
goods that are essential to the continued operation of 
your business/organization and if so, do these 
contractors have business resumption plans in case 
they are also affected by the same disruption that has 
interrupted the functioning of your business? 


Have alternative sources of supply been established? 
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APPENDIX 3 


Additional sources of advice on Business 
Resumption Planning 


Ottawa-area: 

The Disaster Recovery Information Exchange (DRIE) 
P.O. Box 463 

Manotick, Ontario 

K4M 1A5 


Quebec: 

Association DRIE [Désastre : le Rétablissement par 
information et l’échange] 

C.P. 1669, Place Bonaventure 

Montréal (Québec) 

HSA 1H7 


Manitoba, Saskatchewan, Alberta, British Columbia: 
DRIE-West 

P.O. Box 1557, Station ““M”’ 

Calgary, Alberta 

T2P 3B9 


British Columbia: 

Emergency Preparedness Industry and 
Commerce Council (EPICC) 

1110 - 1040 W. Georgia Street 
Vancouver, B.C. 

VO6OE 4H1 

Phone: (604) 687-5522 

FAX: (604) 681-7530 
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Additional copies of this booklet and one entitled 
The Preservation of Essential Records are available from: 


Communications Directorate 
Emergency Preparedness Canada 
122 Bank Street, 2nd Floor 
Ottawa, Ontario K1A OW6 


Phone: (613) 991-7035 


FAX: (613) 998-9589 
e-mail: | cominfo@jackson.epc.epc-pcc.x400.gc.ca 
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